1. Controller and scope
Tripoora is the data controller for personal data processed through the Tripoora marketplace, traveller accounts, the supplier dashboard and our marketing communications. This policy explains what we collect, why, on which lawful basis, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).
For any privacy matter, including requests to exercise your rights, contact privacy@tripoora.com.
2. What we collect
- Identity and contact data: name, email address, mobile number, and the verification status of each channel.
- Booking data: experiences booked, dates, time slots, participant details a supplier legitimately requires (such as names, dates of birth or document numbers for entry), vouchers and scan history.
- Payment data: amount, currency, payment status and the last four digits and brand of your card. Full card details are handled by our PCI-DSS compliant payment provider and are never stored on our systems.
- Account and security data: password hashes, one-time codes, sign-in events, devices and IP addresses used for fraud prevention.
- Usage data: pages viewed, searches, filters, wishlists, plans and the interactions needed to operate and improve the marketplace.
- Communications: messages exchanged with suppliers or our support team, contact form submissions, reviews and newsletter preferences.
- Supplier data: business details, contact people, licences, payout and settlement information for organisations selling on Tripoora.
3. Why we use it, and our lawful bases
- To create and manage your booking, deliver vouchers, run check-in and process refunds — performance of a contract (Art. 6(1)(b) GDPR).
- To verify your email or mobile number and send operational updates such as meeting-point changes or supplier cancellations — performance of a contract and our legitimate interest in reliable delivery.
- To prevent fraud, abuse and chargebacks, and to keep the platform secure — legitimate interests (Art. 6(1)(f)).
- To send marketing emails, destination alerts and the newsletter — your consent (Art. 6(1)(a)), given through double opt-in and withdrawable at any time.
- To place non-essential analytics and marketing cookies — your consent.
- To meet accounting, tax, consumer-protection and anti-money-laundering obligations — legal obligation (Art. 6(1)(c)).
- To handle complaints, disputes and legal claims — legitimate interests and, where applicable, legal obligation.
5. International transfers
We host and process data in the European Economic Area wherever possible. Where a provider processes data outside the EEA, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest. You can request a copy of the safeguards applied.
6. How long we keep data
- Booking, voucher and payment records: retained for the period required by tax and accounting law, typically 7 to 10 years from the booking date.
- Account profile data: for as long as your account is open, then deleted or anonymised within 12 months of closure unless a longer legal retention applies.
- Guest bookings without an account: 24 months after the travel date, then anonymised for statistics.
- Marketing consent records and newsletter data: until you withdraw consent, plus a short record of the withdrawal as proof of compliance.
- Support and dispute correspondence: up to 5 years after the case is closed.
- Security and access logs: normally 12 months.
7. Your GDPR rights
You can exercise any of the rights below free of charge by writing to privacy@tripoora.com, or from the privacy controls in your account. We respond within one month and may ask for proof of identity.
- Access — obtain confirmation of processing and a copy of your data.
- Rectification — correct inaccurate or incomplete data.
- Erasure — have data deleted where it is no longer needed and no legal retention applies.
- Restriction — pause processing while a dispute about accuracy or lawfulness is resolved.
- Portability — receive the data you provided in a structured, machine-readable format, or have it sent to another controller.
- Objection — object to processing based on legitimate interests, and object at any time to direct marketing.
- Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
- Complain — lodge a complaint with the supervisory authority of your country of residence or workplace.
8. Automated decisions and AI features
We use automated checks for fraud and payment risk. These influence whether a booking can be completed; you can ask for human review of any decision that affects you.
Our AI trip planning features send the trip parameters you enter — such as destination, dates, party size and interests — to our AI provider to generate an itinerary. We do not send payment data or document numbers to AI providers, and provider outputs are not used to train third-party models on your data.
10. Security and children
Access to personal data is restricted by role-based access control and row-level security in our database, enforced on the server rather than in the browser. Data is encrypted in transit and at rest, administrative actions are logged, and we operate a documented process for assessing and, where required, notifying personal data breaches to the supervisory authority within 72 hours.
Tripoora is not directed at children. We only process children's data when an adult provides participant details for a family booking, and only for the purpose of delivering that experience.
11. Changes to this policy
We publish any change on this page with a new effective date, and notify registered users by email where the change materially affects how their data is used.